Analytics Story: Browser Hijacking

Date: 2026-01-12 ID: 530d884d-c40f-4da2-bcd6-11d36b36f6ee Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

These behaviors associated with browser hijacking techniques where malware manipulates browser configurations, preferences, or registry settings to alter browsing behavior, disable updates, and install unauthorized extensions. Modern hijackers may directly modify Chrome preference files, use automation to inject unwanted content, or change policy settings (including allowlisting extensions) to persist and evade standard protections. These actions often result in unwanted redirects, malicious extension loading, or persistent policy tampering that can compromise user browsing integrity and system security. Detecting such modifications helps identify potential hijacker activity early and supports incident response efforts.

Why it matters

Browser hijacking is a common tactic used by malicious actors to gain control over a user's browsing experience, often without their knowledge. Attackers manipulate browser settings, install unauthorized extensions, or modify registry keys to redirect traffic, inject ads, or persistently override security policies. In Chrome, this can include altering the Extension Install Allowlist or preference files to load malicious or unwanted extensions automatically. Such modifications not only degrade user experience but can also introduce malware, credential theft, or data leakage. Detecting these registry and policy changes provides early warning of hijacker activity, enabling timely remediation before wider compromise occurs.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Windows Chrome Auto-Update Disabled via Registry	Browser Session Hijacking	Anomaly
Windows Chrome Enable Extension Loading via Command-Line	Browser Session Hijacking	Anomaly
Windows Chrome Extension Allowed Registry Modification	Browser Session Hijacking	Anomaly
Windows Chromium Process Loaded Extension via Command-Line	Browser Session Hijacking	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`

References

https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking

Source: GitHub | Version: 1